[PATCH net] virtio_net: Fix resize of the RX ring

[Anton Protopopov]

When a AF_XDP socket is attached, the virtnet_rx_resize
should resize the rq->xsk_buffs XSK buffer array. Otherwise,
when the size grows, the virtnet_rx_resume() causes a write
past the end of the array. This is easily reproducable with

    ethtool -G ens3 rx 32
    ./xdpsock -i eth0 -q 0 -r -z &
    ethtool -G eth0 rx 256

Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
Signed-off-by: Anton Protopopov <a.s.protopo...@gmail.com>
---
 drivers/net/virtio_net.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2a5876c6c8..e34c52d059d3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info 
*vi)
 static int virtnet_rx_resize(struct virtnet_info *vi,
                             struct receive_queue *rq, u32 ring_num)
 {
+       unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
+       struct xdp_buff **tmp_xsk_buffs = NULL;
        int err, qindex;
 
        qindex = rq - vi->rq;
 
+       if (rq->xsk_pool && ring_num > old_ring_num) {
+               tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
+               if (!tmp_xsk_buffs)
+                       return -ENOMEM;
+       }
+
        virtnet_rx_pause(vi, rq);
 
        err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, 
NULL);
+
+       /* virtqueue_resize may have changed the size even if err != 0 */
+       if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
+               swap(rq->xsk_buffs, tmp_xsk_buffs);
+
        if (err)
                netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: 
%d\n", qindex, err);
 
        virtnet_rx_resume(vi, rq, true);
+       kvfree(tmp_xsk_buffs);
        return err;
 }
 
-- 
2.43.0